Update CORS example.

According to the CORS spec, the POST method is a [simple method](http://www.w3.org/TR/cors/#simple-method) and does not need to be listed as part of the Access-Control-Allow-Methods response header. See number 9 on http://www.w3.org/TR/cors/#resource-preflight-requests 

> If a method is a simple method it does not need to be listed, but this is not prohibited.

This means the line:

```javascript
res.set('Access-Control-Allow-Methods', 'GET, POST');
```

is completely irrelevant for the example.

This PR updates the example with an HTTP method that actually raises an error in case it's not listed as part of the CORS response headers.